Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2022-1456

Poll Maker < 4.0.2 - Admin+ Stored Cross-Site Scripting

The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ays-pro
Products
Poll Maker
CVE-2021-34635

Poll Maker <= 3.2.8 - Reflected Cross-Site Scripting

The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ays-pro
Products
Poll Maker
CVE-2021-24651

Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Ays-pro
Products
Poll Maker
CVE-2021-24483

Poll Maker < 3.2.1 - Authenticated Blind SQL Injections

The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed
Vendors
Ays-pro
Products
Poll Maker